Welchia Worm Nails Navy Marine Corps

About three-quarters of the Navy Marine Corps Intranet has lost network capacity due to an infestation by the Welchia worm (also called Nachi), according to Navy sources.

First seen Monday, the Welchia worm attempts to eradicate the Blaster worm, which spread to millions of Windows-based PCs last week.

Intranet Infected

The Welchia worm exploits the same Remote Procedure Call vulnerability as Blaster, as well as invoking what's called the WebDAV vulnerability in unpatched Windows-based machines. Welchia spreads by scanning for new machines to infiltrate, just as Blaster does.

The Welchia worm has infected an unspecified number of computers within the Navy Marine Corps Intranet, which has about 100,000 users. This has caused the N/MCI, which is managed on an outsourced basis by Electronic Data Systems, to become congested to the point it cannot presently be useful for network connections.

N/MCI is a $6.9 billion IT outsourcing contract, often referred to as seat management, that will give the Navy and Marine Corps secure, universal access to integrated voice, video and data communications.

Worm-Watching

Navy personnel can still use their desktop PCs to do work, but the LAN-based NMCI is not fully functional due to this scanning congestion caused by Welchia, says Nicolle Rose, a Navy spokesperson.

The Navy expects to issue more details about the situation shortly as it tracks down the worm infestation to eliminate it. The Navy wasn't infected with the Blaster worm last week, Rose notes.

Nor does it seem to be battling the Sobig virus that has reappeared in a new version, according to Navy representatives.